As companies become more decentralized, there is a need to provide connectivity to employees located across the country and around the world. Traditionally, companies have established private intra-company communication networks by securing dedicated lines from a long-distance service provider, and/or setting up banks of remote-access servers and modems. Such measures are costly and not particularly scalable.
A virtual private network (VPN) offers an alternative solution to establishing an intra-company communication network. A VPN is a private connection between two machines or networks over a shared or public network, such as the Internet. VPNs allow a company to securely extend its network services over the Internet to remote users, branch offices, and partner companies. In essence, VPNs turn the Internet into a simulated private WAN so that employees in remote areas can easily gain access their company's private network simply by gaining access to the Internet. Cost savings are achieved because leased lines between remote sites and the company are not necessary. In addition, because access to the Internet is widespread, VPNs allow a company to add remote sites easily (i.e., high scalability) without expending costs for connectivity or hardware.
VPNs are implemented through a technique known as tunneling. In tunneling, a data packet from a first protocol is “wrapped” in a second packet from a second protocol before it enters the shared network. That is, a new header from a second protocol is attached to the first packet. The entire first packet becomes the payload of the second one. Tunneling is frequently used to carry traffic of one protocol over a network that does not support that protocol directly. For example, a Network Basic Input/Output System (NetBIOS) or Internet Packet Exchange (IPX) packet can be encapsulated in an Internet Protocol (IP) packet to tunnel it through the Internet. When the encapsulated data packet exits the shared network, the “wrapper” is removed, and the unwrapped data packet is forwarded to its destination address as usual.
For tunneling through the Internet, the data packet must be encapsulated in an IP packet. The IP packet is then forwarded from router to router based on a network layer address associated with the packet. For various reasons, this process is costly and time consuming.
Multi-Protocol Label Switching (MPLS) refers to a technique for tunneling a data packet through a network domain using labels instead of a network layer address. FIG. 1 is a block diagram illustrating a shared MPLS network 100. As is shown, a VPN (VPN1) exists between site 1 (110) and site 2 (112). Site 1 (110) can be an organization's private network in the United States and site 2 (112) can be that organization's remote office in London. In another case, site 2 (112) can be another Internet service provider (i.e., another public network). The shared MPLS network 100 provides a means through which traffic can travel from site 1 (110) to site 2 (112), via VPN1. While FIG. 1 illustrates only one VPN, those skilled in the art recognize that several VPNs generally traverse the network 100.
In MPLS, a Label Switched Path (LSP) 102 is a pre-established path from an ingress point border device 104 at the entry of the network 100 to an egress point border device 106 at the exit. The ingress and egress devices are referred to as Label Edge Routers (LERs). The LSP traverses a number of label switching devices 108a, 108b, which can be routers or switches, within the network 100. FIG. 1 illustrates a single LSP 102 for the sake of clarity. Those skilled in the art recognize that several LSPs can be established in a MPLS network 100, initiating and termination at multiple LERs, which are not shown.
Within an MPLS network 100, routes between ingress LERs 104 and egress LERs 106 are determined and then, as per normal MPLS operation, a label distribution protocol, e.g., Border Gateway Protocol (BGP), is invoked to establish implicit LSPs 102 across the MPLS network 100 which include intermediate hops (across label switching devices 108a, 108b) required to get from an ingress LER 104 to an egress LER 106. The manner in which routes and labels are distributed between LERs (104, 106) and label switching devices (108) is well known to those skilled in the art, and will not be discussed here.
When a packet enters an ingress LER 104, the ingress LER 104 examines the network address of the packet and, based on the IP destination address (e.g., the IP address for site 2 (112)), determines the appropriate egress LER 106 through which the packet should exit, which in turn, determines the appropriate LSP 102 for the packet. The ingress LER 104 then installs in the packet a label corresponding to the appropriate LSP 102, and forwards the packet to a first label switching device 108a in the LSP 102. Each subsequent label switching device along the LSP 102 uses the label to determine the next hop for the packet, and replaces the label in the packet with a new label corresponding to the next hop for the packet. When the packet finally reaches the egress LER 106, the egress LER 106 removes the label from the packet, and forwards the packet to the destination (e.g., site 2 (112)). Thus, only the ingress LER 104 processes the packet at the network layer, and subsequent devices process the packet based upon the label only.
Because the ingress LER 104 determines the LSP 102 using only the IP address of the egress LER 106, a single core LSP 102 between the ingress 104 and egress 106 LERs is established into which multiplexed traffic from different VPNs is passed. Thus, several VPNs must share the resources allocated for the core LSP 102, which can lead to usage problems if one VPN dominates the traffic across the LSP 102 and chokes off traffic from other VPNs. In addition, quality of service (QoS) issues arise in that service level agreements (SLAs) cannot be enforced over the shared network.
Accordingly, a need exists for an improved system and method which supports VPNs in a MPLS. The system and method should provide fairness between VPNs and QoS. The system should also be scalable and easy to implement. The method and system of the present invention addresses such a need.